chore(deps): require fastmcp 4.1.0 and mcp 2.3.0

[christianclaudio]

Why

Template v1.7.0 (#82) raised the FastMCP floor to 4.1.0 and mcp to 2.3.0. This copies both floors here so the product matches the template. Nothing in src/ or tests/ needed to change.

Changes

• pyproject.toml (core and both code-mode / dev extras), fastmcp.json: fastmcp>=4.0.11 becomes >=4.1.0 and mcp>=2.2.0 becomes >=2.3.0.
• uv.lock: refreshed with uv lock --upgrade-package fastmcp --upgrade-package mcp only. No other package was upgraded.
• README.md: the template's idle-session line, added as a paragraph after the endpoint line in "Streamable HTTP", because this README documents serving Streamable HTTP in the default stateful mode.

No source or test changes. No version bump.

Audit (src, tests, docs, README)

• Tool Search (#5467): Regex (default) or BM25 Tool Search is opt-in (src/smartsheet_rm_mcp/server.py:294). Test patterns are plain words (projects_, time_list). The lookarounds and backreferences in errors.py belong to the redaction patterns. Python's re compiles them, not Tool Search, so they are unaffected.
• Code Mode: CodeMode() is called with no arguments (src/smartsheet_rm_mcp/server.py), and max_duration_secs appears nowhere, so the Monty 1.1 rename to max_feed_duration_secs (default 30.0) needs no change; Code Mode inherits the new default.
• HTTP idle expiry (#5229): session_idle_timeout is not set anywhere, so stateful HTTP deployments now expire sessions after 30 idle minutes (HTTP 404, and the client starts a new session). The HTTP tests build stateless apps, and the stateless_http=False assertions only check the arguments passed to run(), so the tests are unaffected. The README line documents this.
• No x-mcp-header annotations (#3620), no ctx.meta / ctx.params reads (#3628), no MultiAuth, no skills, and no OpenAPI ./.. path parameters.

FastMCP 4.1.0 (release) and mcp 2.3.0 (release)

The items that apply here are the Tool Search engine change, the 30-minute idle expiry and the Monty 1.1 rename above. The other breaking items in 4.1.0 (MultiAuth client IDs, skill file paths, OpenAPI path parameters, Python 3.15) touch nothing used here. In mcp 2.3.0, httpx2>=2.10.0 (#3600) was already satisfied. #3630 (Mcp-Param-* lookup by name) and #3635 (OAuth login vs request timeouts, client side) need nothing here.

Lock changes

Package	Before	After
fastmcp	4.0.11	4.1.0
fastmcp-slim	4.0.11	4.1.0
mcp	2.2.0	2.3.0
mcp-types	2.2.0	2.3.0
pydantic-monty	0.0.21	1.1.0
pydantic-monty-client	0.0.21	1.1.0
pydantic-monty-runtime	0.0.21	1.1.0
beartype	0.22.9	0.22.9 (Python < 3.15) and 0.23.0 (Python >= 3.15)

Why beartype is locked twice: this is deliberate, not drift, and it matches template v1.7.0. fastmcp-slim 4.1.0 adds beartype>=0.23.0rc2; python_version >= "3.15" (#5558), so uv forks the resolution at 3.15. Below 3.15, only py-key-value-aio's beartype>=0.20.0 applies, and uv keeps the 0.22.9 already locked because beartype wasn't upgraded. Python 3.10 to 3.13, the versions CI runs, still install 0.22.9.

Tests

No test changes. On Python 3.10, 3.11, 3.12 and 3.13, with CI=true and --extra dev --extra code-mode, 625 passed, 1 deselected (the deselected one is the opt-in e2e test), at 100% coverage. The 3.12 run gave the same result with SMARTSHEET_RM_MCP_AUTH_TOKEN and SMARTSHEET_RM_MCP_ALLOW_UNAUTHENTICATED_BIND exported in the shell.

Gates

• ruff check . and ruff format --check .: clean
• mypy --strict src/: clean
• uv lock --check: clean
• scripts/check_tool_contract.py: passed
• scripts/check_openapi_drift.py: passed (103 operations)
• scripts/check_version.py (on a fresh uv build): passed
• scripts/check_conformance.sh: the baseline check passed (12 passed; all 20 failures are expected and in the baseline)

• The supplied change summary reports dependency minimums of FastMCP 4.1.0 and MCP 2.3.0, plus an updated lockfile.
• The README documents the reported 30-minute idle-session expiry for stateful Streamable HTTP sessions.
• Tool surface: none reported.
• Config: fastmcp.json and pyproject.toml dependency minimums changed. No environment-variable changes are established by the supplied diff output.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: fd22431e-d747-49b4-aebb-7b3822fa6db7

---

📥 Commits

Reviewing files that changed from the base of the PR and between 78491f9 and f912397.

---

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

---

📒 Files selected for processing (3)

• README.md
• fastmcp.json
• pyproject.toml

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (10)

• GitHub Check: Tests (py3.10)
• GitHub Check: Protocol & stdio verification
• GitHub Check: Tests (py3.12)
• GitHub Check: OpenAPI drift validation
• GitHub Check: Lint and types
• GitHub Check: Tests (py3.11)
• GitHub Check: Tests (py3.13)
• GitHub Check: Tool contract and safety gating
• GitHub Check: Build and package check
• GitHub Check: CodeQL Security Scan

---

🧰 Additional context used

📚 Code guidelines (2)

AGENTS.md — configured
README.md — auto-discovered

---

📓 Path-based instructions (4)

Dependency floors.

⚙️ CodeRabbit configuration file

Files:

• fastmcp.json
• pyproject.toml

---

README is the user contract for env vars, tool lists, and install steps: flag text that contradicts the code in this PR (renamed or removed tools, env vars, defaults).

⚙️ CodeRabbit configuration file

Files:

• README.md

---

Source excerpt: FastMCP 4 Server Composition: Root gateway in `server.py` selectively mounts domain sub-servers with native domain namespaces (`namespace="time"`, `namespace="projects"`, `namespace="admin"`).

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• README.md

---

Source excerpt: Console scripts in `[project.scripts]` both call `smartsheet_rm_mcp.server:main`: `smartsheet-rm-mcp` (used below) and `mcp-server-smartsheet-rm`.

📄 CodeRabbit inference engine (README.md)

Files:

• README.md

---

🔇 Additional comments (3)

fastmcp.json (1)

9-10: LGTM!

---

pyproject.toml (1)

24-25: LGTM!

Also applies to: 35-35, 38-38

---

README.md (1)

215-215: LGTM!

---

---

📝 Walkthrough

Walkthrough

The project raises its minimum FastMCP and MCP versions. The Streamable HTTP documentation now describes the default stateful session idle timeout, expiration response, and configuration options.

Changes

HTTP Session Documentation and Requirements

Layer / File(s)	Summary
Dependency minimums fastmcp.json, pyproject.toml	The minimum FastMCP version increases to 4.1.0, and the minimum MCP version increases to 2.3.0. The code-mode and dev dependencies also require fastmcp[code-mode]>=4.1.0.
Session timeout documentation README.md	The documentation describes the default 30-minute idle timeout for stateful HTTP sessions, the HTTP 404 response after expiration, and settings to change or disable the timeout.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested labels: dependencies

---

Merge Risk: ⚪ Minimal · up to f9123

The dependency requirements and session-expiry documentation are consistent with the project’s configuration. No actionable merge-blocking risk remains.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: raising the minimum required versions of FastMCP and MCP.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}